vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

forward the attic container's journal to the swarm collector

Browse source
This commit is contained in:
atlas 2026-10-27 15:22:55 +01:00
commit a572fb6a7f
1 changed files with 230 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

30
nix/module-eval/builder.nix
View file

@ -385,6 +385,36 @@ let
&& lib.hasInfix "--mode monolithic" atticUnit.serviceConfig.ExecStart
&& atticDeploy.retentionPeriod == "14 days";
}
{
# atticd's journal reaches the swarm collector through the container's own
# forwarder, under the cache's store leaf. The host with the switch forced
# off is the control that nothing of it renders there, and `atticHere`
# that the same lookups find it where the cache runs.
name = "the cache's container forwards its journal to the swarm collector as its own client, and only where the cache runs";
ok =
let
inner = atticHere.containers.swarm-attic;
f = inner.config.services.hyperhive.swarmJournalForwarder;
fetch = inner.config.systemd.services.swarm-journal-forwarder-oidc;
collector = inner.config.systemd.services.opentelemetry-collector;
in
f.enable
&& f.serviceName == "attic"
&& f.clientId == "swarm-attic-collector"
&& f.endpoint == "https://${atticHere.services.hyperhive.swarm.otel.domain}/swarm-attic"
&& f.store.secretPath == "secret/swarm/services/swarm-attic-collector/oidc/client"
&& f.store.clientCertFile == "/run/credentials/swarm-journal-forwarder-oidc.service/attic-bao-cert"
&& lib.elem "attic-bao-key" fetch.serviceConfig.LoadCredential
&& lib.elem "--load-credential=attic-bao-cert:/var/lib/swarm-bao-pki/attic.pem" inner.extraFlags
&& !(lib.elem "--link-journal=host" inner.extraFlags)
&& collector.enable
&&
atticHere.services.hyperhive.swarm.otel.serviceProducers.swarm-attic.clientId
== "swarm-attic-collector"
&& lib.hasInfix "services/swarm-attic-collector/oidc/client" atticHere.systemd.services.swarm-bao-attic-policy.script
&& !(atticExternal.containers ? swarm-attic)
&& atticExternal.services.hyperhive.swarm.otel.serviceProducers ? swarm-attic;
}
{
# attic checks its own tokens and a nix client cannot follow a login
# redirect, so the vhost carries no `auth_request`; the tokens ride in a